Security Analyst

EPAM Systems; Stati Uniti; Remoto; USD 70.000 - 100.000; Tempo pieno

Descrizione del lavoro

EPAM Systems Inc. is seeking a talented Security Analyst with experience in Cyber/Information/Network/Cloud Security to monitor enterprise environments.

The role focuses on threat analysis of event data from multiple platforms, with on-shift rotation: 2 days on, 2 days off, 12-hour shifts. Responsibilities include monitoring on‑prem and AWS infrastructure for attacks, managing identity and access, building SIEM and SOAR detection rules, and developing playbooks.

Competenze

• 1+ years of experience with SIEM solutions.
• Experience with SIRP/SOAR tools.
• Knowledge of Internet security and networking protocols.
• Familiarity with intrusions techniques and risk management concepts.
• Proficiency in English at a B2+ level.

Mansioni

• Monitor on-prem and AWS infrastructure for attacks and unusual activity.
• Monitor identity and access management for abuse of permissions.
• Create SIEM and SOAR detection and remediation scenarios as rules.
• Create, test and update playbooks.
• Perform threat hunting and support threat intelligence processes.
• Carry out other security operations activities with monitoring.
• Generate reports for technical and non-technical staff.
• Use analytic tools to identify threat patterns and vulnerabilities.

Conoscenze

SIEM concepts

Threat hunting

Incident response

English proficiency

Strumenti

Splunk

QRadar

ArcSight

LogRhythm

ELK

Wazuh

TheHive

Cortex

Phantom

XSOAR

Resilient

Descrizione del lavoro

We are looking for a talented Security Analyst experienced in Cyber/Information/Network/Cloud Security in enterprise environments, with basic knowledge of threat analysis of event data from commercial and open-source infrastructure technology platforms. Shift rotation is 2 days on, 2 days off, 12 hours, with 11 work hours and 1 hour for rest.

Responsibilities

• Monitor on-prem and AWS infrastructure for attacks, intrusions and unusual, unauthorized or illegal activity
• Monitor identity and access management, including monitoring for abuse of permissions by authorized system users
• Create SIEM and SOAR detection and remediation scenarios, and implement them as rules
• Create, test and update playbooks
• Perform threat hunting and support threat intelligence processes
• Carry out other security operations activities alongside security monitoring
• Generate reports for both technical and non-technical staff and stakeholders
• Use advanced analytic tools to determine emerging threat patterns and vulnerabilities

Requirements

• 1+ years of experience with SIEM solutions such as Splunk, QRadar, ArcSight, LogRhythm, ELK or Wazuh
• Experience with SIRP/SOAR tools such as TheHive, Cortex, Phantom, XSOAR or Resilient
• Knowledge of Internet security, networking protocols, and related technologies, including IDS/IPS, firewalls and content filtering
• Familiarity with Network Behavior Analysis tools, anti-malware, and packet inspection
• Understanding of Windows, Linux, DB and network device monitoring and logging techniques
• Understanding of host and network security hardening, networking protocols, common intrusion techniques and common risk management concepts
• Knowledge of malware detection, intrusion detection and prevention systems
• Proficiency in English at a B2+ level
• Nice to have Experience with AWS
• Experience with network security
• Experience with Firewalls such as F5, Juniper, Check Point, Palo Alto or Cisco